Repository navigation
This week's second round of dependency updates, and the Docker catalog entry at 0.21.0 - #918
Merged
Merged
Conversation
…r catalog entry's source.commit at 0.21.0 Dependabot's own diffs, each generated on Linux, applied together (one CI run instead of eight): #909 (website React 19.3.1), #911 (pypa/gh-action-pypi-publish 1.14.3), #912 (the Python OpenTelemetry recipes), #913 (typescript-eslint 8.72.0), #914 (the JS OpenTelemetry recipe), #915 (@anthropic-ai/sdk 0.136.0, openai 7.39.0), #916 (@langchain/langgraph 1.5.1), #917 (dashboard lucide-react 1.60.0, react-router 8.5.0, typescript-eslint 8.72.0). Against main nothing is downgraded; npm audit is 0 in every lockfile but the root's two recorded development-tool rows; actionlint passes. docs/launch/listings/docker/server.yaml carries the 0.21.0 release commit, as the docker/mcp-registry entry now does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Iris gate — 1 of 2 tripped
|
| Trace | Verdict | Basis | Rules, classes or missing inputs | Evidence |
|---|---|---|---|---|
b880f5c7e45142bb22906ea19289e137 |
failed | detector_veto + risk_over_loss |
no_pii, pii_leak, credential_leak | no_pii: AWS Access Key (output 45–65) |
| Verdict basis | Traces |
|---|---|
detector_veto |
2 |
clean |
1 |
Unjudged questions: task_completed (3), tool_use_correct (3) — a trace that did not carry what a rule needs.
tests/fixtures/ci-gate/traces.ndjson · 3 evaluated · dataset release-gate: 2 in the gate · exit 1 · what the bases mean
Iris gate — 1 stored, nothing tripped
|
| Verdict basis | Traces |
|---|---|
clean |
1 |
Unjudged questions: task_completed (1), tool_use_correct (1) — a trace that did not carry what a rule needs.
tests/fixtures/ci-gate/clean.ndjson · 1 evaluated · exit 0 · what the bases mean
…ewest; its half-published 3.x line is ignored for now #914 moved @opentelemetry/resources to 3.0.0, the OTLP exporter to 0.300.0 and the API to 1.10.0, but left sdk-trace-base and sdk-trace-node on 2.12.0, whose peer range is api <1.10.0: npm refused to install it (ERESOLVE), so the recipe job failed. sdk-trace 3.x is not published yet, and OpenInference's instrumentation needs core ^2.8.0, so no consistent 3.x set exists today. The recipe takes the newest consistent set: api 1.9.1, core, resources and both trace SDKs 2.12.0, the exporter 0.223.0, with #914's other updates (@openai/agents 0.20.0, OpenInference core 2.8.0 and its OpenAI Agents instrumentation 0.3.2). Regenerated on Linux; npm ci resolves one API copy; nothing is downgraded against main; npm audit 0. dependabot.yml ignores the 3.x line in this directory, with the condition that lifts it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tion-llama-index 4.5.2 (#919) With 4.6.0 (from #912) and 4.6.1 the recipe runs and answers but Iris stores no matching trace, so its job failed. 4.5.2 with every other new pin (llama-index-llms-openai 0.8.3, OpenTelemetry SDK and exporter 1.45.1) passes 2 of 2 locally. #919 tracks the cause with a plan; dependabot.yml holds the package below 4.6.0 until then. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Dependabot updates opened since the last batch (#901), applied together so CI runs once instead of eight times. Each is Dependabot's own diff, generated on Linux, applied unchanged, except #912 and #914 (below); they touch eight different lockfiles or files, so none overlaps another.
website/publish-python.ymlpypa/gh-action-pypi-publish1.14.3 (the same commit pin Dependabot proposed)examples/otel-recipes(Python)llama-index-llms-openai0.8.3, OpenTelemetry SDK and OTLP exporter 1.45.1,openai-agents0.24.0,openinference-instrumentation-openai-agents2.5.3;openinference-instrumentation-llama-indexstays at 4.5.2 (see below)examples/otel-recipes/js@openai/agents0.20.0, OpenInference core 2.8.0 and its OpenAI Agents instrumentation 0.3.2, and OpenTelemetry's 2.x line at its newest: core, resources and both trace SDKs 2.12.0, the OTLP proto exporter 0.223.0, the API 1.9.1 (see below)packages/sdk@anthropic-ai/sdk0.136.0,openai7.39.0packages/langchain@langchain/langgraph1.5.1dashboard/Against
main, no lockfile downgrades anything.npm auditreports 0 in every lockfile except the root, where it reports only the two development-tool rowsSECURITY-EXPOSURE.mdrecords; none of the new Python pins has a published advisory.actionlintpasses. Locally, with these lockfiles installed: lint, the type checks, the dashboard's tests and the website's lint and types pass. The OpenTelemetry recipes take pre-1.0 moves (openai-agents0.24,@openai/agents0.20); their recipe jobs here are the check that they still send traces Iris scores.Why #914 is adjusted. As Dependabot proposed it, #914 moved OpenTelemetry resources to 3.0.0, the exporter to 0.300.0 and the API to 1.10.0 while
sdk-trace-baseandsdk-trace-nodestayed on 2.12.0, whose peer range is API<1.10.0, so npm refused to install it (ERESOLVE) and the recipe job failed. OpenTelemetry JS has published 3.x of core, resources and the exporters but not of the trace SDKs, and OpenInference's instrumentation needs core^2.8.0, so no consistent 3.x set exists yet. The recipe takes the newest consistent set instead, regenerated on Linux (one API copy, nothing downgraded,npm audit0), anddependabot.ymlignores the 3.x line in that directory until the trace SDKs publish 3.x.Why #912 is adjusted. With
openinference-instrumentation-llama-index4.6.0, as #912 proposed, and with 4.6.1, the LlamaIndex recipe runs and answers but Iris stores no trace whose input is its question, so the recipe job failed. 4.5.2 with every other new pin passes. #919 tracks the cause, with a plan;dependabot.ymlholds that one package below 4.6.0 until it is fixed.Also:
docs/launch/listings/docker/server.yamlcarries the 0.21.0 release commit, as thedocker/mcp-registryentry it mirrors now does.🤖 Generated with Claude Code